PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 5 / c5.3
Efficient Application SecuritySecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.3 Anti-phishing protection with email and browsing controls

Implement technical mechanisms that detect and protect personnel against phishing attacks, complementing the awareness training of Requirement 12.6.

Quick Wins
Foundational
Efficient
Optimized
Effort: Medium Impact: Medium Applies to CDE: No

Requirement 5

Protect All Systems and Networks from Malicious Software

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

5.4 Anti-phishing mechanisms protect users against phishing attacks
  • 5.4.1 Processes/automated mechanisms detect and protect against phishing Covered

How to implement on AWS

Configure email authentication (SPF, DKIM, DMARC) on domains managed with Amazon SES/Route 53. Integrate anti-phishing filtering at the email gateway. Use Route 53 Resolver DNS Firewall to block known malicious domains. Correlate signals with GuardDuty.

Practical implementation

How this control is implemented in each reference architecture:

Back the awareness training (Req 12.6) with technical anti-phishing: authenticate your email and block known-malicious domains at DNS.

  1. Configure SPF, DKIM, and DMARC for your sending domains (managed with Amazon SES and Route 53) so spoofed mail is rejected.
    Domain / email Amazon SES Route 53 DNS Firewall
  2. Use Route 53 Resolver DNS Firewall to block known-malicious domains from the account's VPC.
    VPC DNS egress Route 53 DNS Firewall
  3. Correlate phishing/malware signals with GuardDuty for detection.
    Account-wide detection GuardDuty

How to validate: DMARC is set to quarantine/reject with SPF+DKIM aligned, and a DNS query to a known-bad test domain is blocked by DNS Firewall.

Avoid: Relying only on user training. Pair it with email authentication and DNS blocking so a click is less likely to reach a malicious destination.

Single-account, 3-tier →

Manage email authentication and DNS Firewall rule groups centrally and share them, so anti-phishing DNS controls are consistent org-wide.

  1. Manage SPF/DKIM/DMARC for the org's domains centrally (SES + Route 53 in a shared account).
    Network/shared account Amazon SES Route 53 DNS Firewall
  2. Author the DNS Firewall rule groups once in the network account and share them (AWS RAM) to the VPCs of all accounts.
    Network/inspection account → all VPCs Route 53 DNS Firewall AWS RAM
  3. Correlate signals org-wide in the delegated-admin GuardDuty/Security Hub.
    Security tooling account GuardDuty Security Hub

How to validate: The shared DNS Firewall rule groups are associated to every account's VPC, and DMARC enforcement is verified for the org's domains.

Avoid: Per-account DNS Firewall rules maintained separately. They drift; author once centrally and share to every VPC.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Observe implemented processes and examine mechanisms to verify that controls are in place to detect and protect personnel against phishing attacks (5.4.1).

Evidence in AWS

  • SPF/DKIM/DMARC DNS records configured in Route 53.
  • DNS Firewall rules blocking malicious domains.
  • Anti-phishing filtering configuration at the email gateway.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 5.4 — Mechanisms are in place to protect against and mitigate risk posed by phishing attacks.

AWS services

Amazon SES Amazon Route 53 Resolver DNS Firewall Amazon GuardDuty

Learning resources

References

  • PCI DSS v4.0.1 Requirement 5.4